CVE-2026-64436

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: af_key: initialize alg_key_len for IPComp states

pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by

allocating x->calg and copying only the algorithm name:

x->calg = kmalloc_obj(*x->calg);

if (!x->calg) {

err = -ENOMEM;

goto out;

}

strcpy(x->calg->alg_name, a->name);

x->props.calgo = sa->sadb_sa_encrypt;

Unlike the authentication (x->aalg) and encryption (x->ealg) branches of

the same function, the compression branch never initializes

calg->alg_key_len. IPComp carries no key and the allocation only

reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field

is left containing uninitialized slab data.

calg->alg_key_len is later used as a length by xfrm_algo_clone() when an

IPComp state is cloned during XFRM_MSG_MIGRATE:

xfrm_state_migrate()

xfrm_state_clone_and_setup()

x->calg = xfrm_algo_clone(orig->calg);

kmemdup(orig, xfrm_alg_len(orig));

where

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References